diff --git a/extra-manifests/toolshed-deployer-rbac.yaml b/extra-manifests/toolshed-deployer-rbac.yaml
index 644934e..a38b920 100644
--- a/extra-manifests/toolshed-deployer-rbac.yaml
+++ b/extra-manifests/toolshed-deployer-rbac.yaml
@@ -57,6 +57,13 @@ rules:
   - apiGroups: ["apps"]
     resources: ["deployments"]
     verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  # A one-off command run against an app executes in a throwaway Job built
+  # from the app's own image — see internal/deploy.Client.RunCommand. Delete
+  # is needed because the Job is removed once its output has been captured;
+  # without it they accumulate one per command forever.
+  - apiGroups: ["batch"]
+    resources: ["jobs"]
+    verbs: ["get", "list", "watch", "create", "delete"]
   # An app with persistent storage is a StatefulSet instead of a Deployment
   # (internal/deploy.Client.ensureStatefulSet). Delete is needed on both:
   # switching an app between stateless and stateful must remove whichever